Category I Data: Assessing and Securing Sensitive Information
UT's Data Classification System
UT policy requires that all data stored on university resources be classified into one of three categories, known simply as I, II, and III, that describe its level of sensitivity. Data should be assessed according to its need for:
- Confidentiality—need to strictly limit access to data
- Integrity—data must be accurate, users must be able to trust its accuracy
- Availability—data must be accessible to authorized persons, entities, or devices
If just one of these “CIA” criteria is required for a set of data, that data is considered Category I data.
When assessing data, think about the loss or negative impact to UT that would occur if any of the CIA criteria were compromised.
- Would students or employees be at risk for identity theft?
- Would the department be able to carry out its critical functions or services?
- Would UT’s reputation or ability to attract research funding suffer?
To read more about UT’s data classification guidelines and how to assess data, please see UT's Data Classification Guidelines.
Category I Data Examples
College of Education faculty and staff may work with Category I Data related to:
- Donors and alumni
- Vendors or other business contacts
- Social Security numbers (SSN)
- Personal contact information (if student or
employee has restricted it)
- Personal financial information
- Insurance benefit information
- Access device numbers (i.e., alarm codes)
- Accounts and contract information
Category I research information includes:
- Funding/sponsorship information
- Human subject information
- Sensitive research data
Category I institutional data includes:
- Financial and credit card records
- Physical Plant detail
- Critical infrastructure detail
Look for Category I data in such files as:
- Employee evaluation forms
- Student academic records
- Databases of contact information
- Old Web site forms or databases with SSN fields
- Accounting records
For more examples of Category I data see UT's Extended List of Category I Data.